ForceChangePassword is the BloodHound label for an Active Directory right that allows one account to reset another account’s password without knowing the current one. This is a high-risk permission because it can be chained with other access rights to take over accounts, especially when combined with group or administrative control.
What ForceChangePassword Means in Active Directory
ForceChangePassword is an Active Directory control that lets one account reset another account’s password without knowing the current one. In practice, it is a delegated administrative right, not a password discovery capability.
This permission is often present in delegated support, help desk, or domain administration workflows. The key security question is who holds it, over which target accounts, and whether that scope is still justified.
Why This Right Is Security-Sensitive
ForceChangePassword changes control over an account rather than merely granting access to data. If an attacker or insider can use it on a valuable target, they can invalidate the target’s current password and immediately take over the account through the next authentication event.
That makes the right especially dangerous when it is assigned broadly, inherited through group membership, or paired with other administrative rights. It is less about the password-reset action itself and more about the authority to seize an identity.
How It Is Commonly Abused
In a Windows domain, this right is frequently part of privilege escalation chains. An actor who already has some foothold may use it to reset a more powerful account, then leverage that account for access to systems, groups, or higher-value permissions.
It is also a common lateral-movement enabler when the reset target belongs to a service, delegated admin, or help-desk function. The abuse path is simple, which is why defenders should treat it as a high-impact authorization primitive rather than a routine operational convenience.
What Good Governance Looks Like
Good governance starts with narrow assignment, clear ownership, and regular review of every principal that can exercise the right. The permission should be justified on a per-target basis, especially where it reaches privileged users, sensitive groups, or accounts that gate access to critical infrastructure.
It should also be evaluated alongside adjacent rights such as group membership, delegation, and administrative inheritance. A reset permission that looks harmless in isolation may become a takeover path once combined with broader directory control.
Risk and Threat Considerations
ForceChangePassword creates direct account-takeover risk because it lets the holder invalidate the victim’s current password and assume control through the next login or credential use. In a domain environment, that can turn a single delegated right into a fast privilege-escalation path.
Failure mechanism: Excessive or poorly scoped reset authority is abused on privileged or widely trusted accounts, often after an initial foothold or through inherited group membership.
Impact: The attacker or insider can seize the account, pivot to adjacent systems, and potentially reach higher-value administrative control without needing the existing password.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | ForceChangePassword is a delegated privilege that should be minimized to reduce takeover exposure. |
| IA-5 — Authenticator Management | This right directly affects password lifecycle and authenticator reset handling. | |
| AC-2 — Account Management | The permission must be governed through account ownership, scope, and review. | |
| Recommendation — Limit password-reset authority to the smallest set of approved administrators. Control password reset workflows so only authorized roles can reissue authenticators. Review who can reset whose accounts and remove unnecessary delegated rights. | ||
| NIST CSF 2.0 | PR.AA-05 — Managed Access Control | The term is fundamentally about enforcing and governing access authority in a directory. |
| ID.AM-01 — Physical devices and systems within the organization are inventoried | Directory account rights are easier to govern when identities and targets are inventoried. | |
| Recommendation — Apply managed access controls to constrain who can reset privileged passwords. Maintain an inventory of privileged accounts and delegated reset paths. | ||
Practitioner Guidance
Why practitioners should care: This right is one of those directory permissions that looks operational until it becomes an access-seizure mechanism. Treat every assignment as a deliberate trust decision, not a convenience setting.
What to watch for: Pay special attention to accounts with broad scope, indirect inheritance, or access to privileged targets. If the permission can reach administrators, service principals, or other high-value identities, it deserves immediate scrutiny.
Practitioner takeaway: The safest default is to keep password-reset authority tightly bounded, explicitly owned, and continuously reviewed.
